However, the most popular implementations (like in iOS/macOS) use TouchID/FaceID/Passcode to protect access to the passkey.
That doesn't preclude other implementations from doing it other ways.